Blacknurse – Low bandwidth ICMP firewall attack

Re:Blacknurse – Low bandwidth ICMP firewall attack by imglorp on Monday November 14, 2016 @11:38AM (#12950963)

So, what's the current recommendation on accepting public ICMP these days? There used to be some debate on the tradeoff between usefulness and security.

[ Parent | on HN ]

Re:Blacknurse – Low bandwidth ICMP firewall attack by user5994461 on Monday November 14, 2016 @04:03PM (#12953344)

> So, what's the current recommendation on accepting public ICMP these days?

The recommendation is to accept ALL ICMP traffic, from everywhere, to everywhere, whatever it is.

I've wasted too much time debugging tricky network issues because a dude thought that blocking ICMP was a great idea.

[ Parent | on HN ]

Re:Blacknurse – Low bandwidth ICMP firewall attack by jlgaddis on Monday November 14, 2016 @04:47PM (#12953669)

http://shouldidisableicmp.com

ICMP types 3 and 4 should always be allowed.

At your discretion, you may allow other types as well.

Inbound, I allow types 0, 3, 4, 8, and 11, but I'm a network engineer. A paranoid security guy may prefer to block some of those.

[ Parent | on HN ]

Re:Blacknurse – Low bandwidth ICMP firewall attack by kevin_b_er on Monday November 14, 2016 @11:51AM (#12951104)

For IPv4, yes. ICMP is required to route ipv6 correctly.

[ Parent | on HN ]

Re:Blacknurse – Low bandwidth ICMP firewall attack by Arnt on Monday November 14, 2016 @12:42PM (#12951615)

It's required for v4 too, if you want PMTU discovery to work.

[ Parent | on HN ]